Privacy Policy
Last updated: March 22, 2026
mp3tomp4.app is built on a simple principle: your files are your business. All audio and image processing happens entirely in your browser using WebAssembly. Your files are never uploaded to any server. We use analytics only with your explicit consent.
Data Controller
The data controller responsible for this website pursuant to Art. 4(7) GDPR is:
Louis-Deniel Rost
c/o flexdienst - #10303
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Deutschland
Email: louisdev.info@gmail.com
For full contact details, see our Legal Notice.
Data Protection Officer
As a micro-enterprise with fewer than 10 employees that does not regularly process sensitive personal data at scale, the appointment of a Data Protection Officer is not required under GDPR Art. 37. For all data protection inquiries, please contact the data controller directly at louisdev.info@gmail.com.
What We Don't Collect
We want to be explicit about what we never do:
- No file collection. Your MP3 files, images, and converted MP4 videos are never uploaded to any server. Everything stays on your device.
- No personal data. We do not ask for your name, email, or any identifying information. There are no accounts or sign-ups.
- No server-side processing. There is no backend that handles your files. The conversion runs entirely in your browser.
How It Works
mp3tomp4.app uses FFmpeg.wasm, a version of the industry-standard FFmpeg multimedia framework compiled to WebAssembly. When you select files and click convert, the following happens:
- Your browser loads the FFmpeg WebAssembly binary (a one-time download cached by your browser).
- Your MP3 and image files are read into browser memory — they are never sent over the network.
- FFmpeg.wasm processes the files locally, combining the audio and image into an MP4 video.
- The resulting MP4 file is made available for download directly from your browser's memory.
At no point during this process do your files leave your device. If you close the tab, the files are discarded from memory.
Cookies & Tracking Technologies
We use cookies and similar technologies only with your explicit, prior consent. When you first visit the site, a consent banner lets you accept, reject, or customize your preferences. No tracking scripts are loaded until you actively consent.
Cookie Categories
Necessary (always active)
These use localStorage only — no cookies are set. Stored data includes your theme preference, converter presets, last-used settings, and your consent choice. This is exempt from consent under ePrivacy Art. 5(3) / TTDSG § 25(2) because it is strictly necessary for the service you requested.
Analytics (opt-in)
If you consent, we use Google Analytics 4 to understand how the site is used so we can improve it. GA4 may set the following cookies:
_ga— Distinguishes unique users. Duration: 2 years._ga_<ID>— Maintains session state. Duration: 24 hours.
IP addresses are anonymized. Legal basis: your consent (GDPR Art. 6(1)(a)). Data processor: Google Ireland Limited, with Standard Contractual Clauses for transfers outside the EEA.
You can opt out of Google Analytics by: revoking your consent via the “Cookie Settings” link in the footer, using the Google Analytics Opt-Out Browser Add-on, or disabling cookies in your browser settings.
Marketing (opt-in)
Currently not active. This category exists for potential future use. No marketing cookies are set at this time.
You can change or withdraw your consent at any time by clicking “Cookie Settings” in the footer. When you revoke analytics consent, all GA cookies are deleted immediately.
Error Tracking (Sentry)
If you consent to analytics, we use Sentry (operated by Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA) to automatically detect and diagnose software errors. This helps us fix bugs and improve the reliability of the converter.
Data collected: Browser type and version, operating system, device type, error messages and stack traces, and the page URL where the error occurred. We have disabled IP address storage in our Sentry project settings and configured the SDK to not collect personally identifiable information (sendDefaultPii = false).
Legal basis: Art. 6(1)(a) GDPR (your explicit consent). Sentry is only loaded after you accept analytics in the cookie banner. You can withdraw consent at any time via “Cookie Settings” in the footer.
Data transfer: Our Sentry organization uses EU data residency (Frankfurt, Germany). Error data is stored and processed within the EU. Functional Software, Inc. is certified under the EU-US Data Privacy Framework. We have entered into a Data Processing Agreement (DPA) with Sentry in accordance with Art. 28 GDPR. See Sentry's Privacy Policy.
Hosting
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the site, Vercel automatically collects and stores information in server log files that your browser transmits, including:
- IP address
- User-Agent string
- Requested URL
- Date and time of access
- Browser type
- Referrer URL
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring stable, secure operation of the website). See Vercel's Privacy Policy.
Vercel is certified under the EU-US Data Privacy Framework (DPF), which provides an adequate level of data protection pursuant to an adequacy decision by the European Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023). Server log data is retained by Vercel for up to 30 days. We have entered into a Data Processing Agreement (DPA) with Vercel in accordance with Art. 28 GDPR.
Third-Party Services
The following external resources may be loaded by mp3tomp4.app:
- FFmpeg.wasm via jsDelivr CDN — The WebAssembly binary that powers the converter is fetched from cdn.jsdelivr.net, operated by Prospect One, Krolewska 65A, 30-081 Krakow, Poland. When your browser downloads this file, the following data is transmitted to jsDelivr: your IP address, User-Agent, and Referer headers. This is technically necessary for the converter to function. Legal basis: Art. 6(1)(f) GDPR (legitimate interest — the converter cannot operate without this binary). See jsDelivr's Privacy Policy. We do not currently have a formal Data Processing Agreement with Prospect One, as jsDelivr operates as a public, open-source CDN and processes only transient connection metadata.
- Google Analytics 4 — loaded from googletagmanager.com only if you consent to analytics cookies. Data processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC (USA) is certified under the EU-US Data Privacy Framework. We have accepted Google's Data Processing Amendment. IP addresses are anonymized. Legal basis: Art. 6(1)(a) GDPR (your consent). See Google's Privacy Policy.
Local Storage
mp3tomp4.app uses your browser's localStorage to save a small amount of non-identifying configuration data. This data is stored locally on your device, never transmitted anywhere, and contains no tracking or identifying information. You can clear it at any time through your browser settings.
Strictly Necessary
Your cookie consent choice and theme preference (light or dark mode). These are exempt from consent under ePrivacy Art. 5(3) / TTDSG § 25(2) because they are strictly necessary for the service to function as requested.
Functional
Your converter presets (saved format/size/visualizer combinations) and last-used settings. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in remembering your preferences). Also exempt under ePrivacy Art. 5(3) / TTDSG § 25(2) as functionality explicitly requested by the user.
Your Rights
Under the GDPR, you have the following rights:
- Right to withdraw consent (Art. 7(3)) — at any time via the “Cookie Settings” link in the footer, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Right of access (Art. 15) — you may request confirmation of whether we process personal data about you and, if so, obtain a copy.
- Right to rectification (Art. 16) — you may request correction of inaccurate personal data.
- Right to erasure (Art. 17) — you may request deletion of your personal data, subject to legal retention obligations.
- Right to restriction of processing (Art. 18) — you may request that we restrict the processing of your personal data under certain circumstances.
- Right to data portability (Art. 20) — you may request to receive your personal data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — you may object to the processing of your personal data based on legitimate interests at any time.
- Right to lodge a complaint (Art. 77) — you may lodge a complaint with a supervisory authority. The competent authority for Germany is the data protection authority of the federal state in which you reside. A list is available at bfdi.bund.de.
Since we do not store personal data on our servers (all file processing is client-side), most of these rights are automatically fulfilled. For any requests, contact louisdev.info@gmail.com. We will respond to your request within 30 days. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in accordance with Art. 12(3) GDPR. We may ask you to verify your identity before processing your request.
Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of GDPR Art. 22.
Contact
Questions about this privacy policy? Email louisdev.info@gmail.com.
Changes to This Privacy Policy
We may update this privacy policy from time to time. Material changes will be announced on the website. The revised version will be indicated by the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated privacy policy.